Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121128
Message-ID: <6529a816-e229-cfbb-26e4-1cc835279fd9@bastelstu.be>
Date: Fri, 22 Sep 2023 09:25:10 +0200
MIME-Version: 1.0
To: Nicolas Grekas <nicolas.grekas+php@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <a9b0d24f-fe59-75af-4b1e-dcd8067482b0@bastelstu.be>
 <CAOWwgp=cJWtF8GS6h9Aq42bwJXTwbkG1L1LpcS7HLqK0hrj5rQ@mail.gmail.com>
Content-Language: en-US
In-Reply-To: <CAOWwgp=cJWtF8GS6h9Aq42bwJXTwbkG1L1LpcS7HLqK0hrj5rQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] [VOTE] Increasing the default BCrypt cost
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 9/22/23 09:04, Nicolas Grekas wrote:
> For the record, I voted for 11 because I think it's nicer to end users (I
> guess many don't know they could have a potential DoS vector via password
> submissions), and also because it's going to be easy to raise again in
> 8.5/9.0.
> 
> I was wondering if you considered also raising the Argon2 default cost? Has
> this been discussed?

I did not consider this, because I don't have sufficient knowledge about 
Argon2's behavior to write up a proper RFC for that without spreading 
misinformation. For the reasons mentioned in 
https://news-web.php.net/php.internals/120996, I do not use Argon2 myself.

See also this comment for further information: 
https://github.com/laravel/laravel/pull/6245#issuecomment-1730504804 and 
the Fediverse thread I linked in the initial email opening the vote.

Best regards
Tim Düsterhus